This is the Privacy Policy (hereinafter referred to as – the “Policy”) of the LLC (SIA) Moller Auto Insurance Services No. 40203453186.
Šī ir SIA Moller Auto Insurance Services, reģistrācijas Nr. 40203453186; (turpmāk “Mēs”, “Mūsu”, “Mums”) Privātuma politika (turpmāk “Politika”).
Its purpose is to explain to data subjects how We process the data of natural persons, transparently communicate the procedures and measures for exercising the rights of data subjects, and to describe other issues related to the protection of the data of natural persons. It is also developed to ensure that data subjects can exercise their legal rights in a simple, accessible, and understandable way. As the legal framework for the protection of natural persons' data sets the general objective of ensuring the privacy of individuals and the only way to ensure the fulfilment of this objective is to make the protection of personal data an integral part of the activities of private and public entities, we ensure that all the personal data that come into Our possession are adequately protected and kept secure. Adequate protection means the use of the necessary technical and organisational means and the processing of personal data in accordance with the regulatory framework.
The Policy has been developed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as – the “Regulation”), as well as the Personal Data Processing Law and other laws and regulations governing the processing of personal data.
The terms used in this Policy and their meaning are the same as those defined in Article 4 of the Regulation.
We encourage all data subjects to read this Policy carefully from time to time to obtain up-to-date information about our processing of personal data as a data controller, as this Policy may change over time.
For information on the data processing carried out in relation to cookies, please refer to our Cookie Policy.
1. Who is responsible for processing Your personal data?
We:
LLC (SIA) Moller Auto Insurance Services No. 40203453186, legal address: Riga, 10 Sergeja Eizenšteina Street, LV-1079;
process Your personal data:
1) as a data controller, in relation to Our customers, visitors to car showrooms/offices and other premises, visitors to websites, marketing activities on social networks.
2) as a processor in relation to the placement of leasing and insurance offers on our website. Please be advised that in this case the processing of Your personal data is carried out in cooperation with the leasing and insurance companies that provide the respective services based on a mutual cooperation agreement concluded between Us. Please note that in this case, We, as cooperation partners of leasing and insurance providers, only offer You the possibility to obtain and complete
an initial application for a leasing or insurance transaction via Our website free of charge, which We pass on to the relevant service provider. We do not provide advice in this regard, nor do we enter into contracts on behalf of service providers. Therefore, in this case, the respective providers of leasing and insurance services are the controllers of Your personal data, as they determine the purposes and means of processing personal data, and we process Your personal data on behalf of and for these controllers.
Please also note that leasing and insurance providers may also ask You for additional information to assess the feasibility and content of the transaction. For detailed information on the processing of data by these data controllers, including the reasons for information requested, the lawful basis and the purpose of the processing, please refer to the resources of each service provider.
Our contact details on matters related to personal data processing:
1) e-mail [email protected] , as well as
2) The legal addresses indicated in Clause 1.
You can use this contact information to ask questions about the processing of personal data, exercise Your rights or report a possible breach of data protection.
2. General provisions and categories of personal data
The Policy applies to the following groups of data subjects (collectively – “Customers”, “You”, “Your”):
1) natural persons – Our customers (including potential, former and existing customers);
2) Visitors to Our showrooms, offices, and other premises, including that subject to CCTV;
3) Visitors to the websites we maintain;
4) natural persons whose personal data is processed on social networks in connection with Our marketing activities;
The Policy applies to data processing regardless of the form and/or medium in which the Customer provides personal data (on-site, on Our website, on paper, electronically or by phone).
As a part of our business activity, we mainly process the following categories of Customer personal data:
| Nr. | Category | Examples of data falling into the data category |
| 1. | Identification data | name, surname, date of birth, personal identity number / ID number, driver's licence number (for test drive contracts) |
| 2. | Residence data | address, place of residence |
| 3. | Contact details | telephone, e-mail, declared address, residential address |
| 4. | Vehicle details | cars make, model, state registration and VIN number, mileage, photos, damage information, owner, holder, colour, information on contents of repair works (number, due date), insurance conditions and terms, fuel consumption |
| 5. | Payment-related information | account number, payment institution / credit institution, origin of money, place of employment, currency of payment |
| 6. | Information from video surveillance | digital image and related information |
| 7. | Information processed in the event of a visit to the website | IP address, network, and location data, as well as other information that You consent to the processing of as part of Your visit to the website, including cookies; We may also receive information about Your activities on our website from other sources, such as partners and advertisers |
| 8. | Information processed on social networks | a social network profile and the public information contained therein |
| 9. | Information You give us yourselves | if You contact us, for example to ask a question, we keep all the relevant information, including the content of the communication |
| 10. | Information processed within the framework of a purchase or provision of services | Information on services and/or purchases received on the merits (content) |
3. Sources of obtaining personal data
We may obtain Your personal data mainly in the following ways:
| Nr. | Type | Examples |
| 1. | You personally provide personal data for processing, including by expressing Your consent to the processing of that personal data by Your actions and behaviour | For example, by visiting Our website and/or using Our tools (mobile applications), applying for leasing services, applying for insurance services, asking questions or otherwise contacting Us, for example, by writing to the e-mail addresses managed by Us or Our employees, as well as by using Our services in other way, including by visiting Our office in person or using vehicle systems |
| 2. | Data We obtain from publicly available information | For example, from public registers, requesting information from the institutions maintaining these registers - public authorities or by using freely available information from different sources. |
| 3. | In certain cases, we may also obtain personal data from other subjects, such as other legal or natural persons, as well as from public authorities, including courts and law enforcement authorities | For example, if the provision of service is related to an insurance claim, or You have engaged a third party, such as a credit institution, to receive Our service, we may also obtain personal data in this way from other groups or related parties in order to provide services to You |
In the event that You freely provide us with personal data, please consider the purpose for which the personal data is provided and the amount of personal data necessary and transferable to achieve that purpose. We ask You to provide personal data only to the extent necessary for the purpose of the letter, request, or question and, in particular, not to provide Your personal identification number, health and other special (confidential) data, financial data, other excessive or irrelevant personal data.
4. Purporses for processing personal data
As part of our business activities, We mainly process personal data for the following purposes:
| Nr. | Nolūks | Piemēri |
| 1. | For the provision of services and sale of goods |
· for the identification of the customer; · |
| 2. | For business planning and analytics | · for commercial activity |
| 3. | For Customer safety, protection of company property |
· for information security |
| 4. | For other specific purposes for which the Customer's consent will be obtained most frequently or an offer to opt out of processing | · for sending commercial communications or placing cookies · in cases of leasing or insurance applications |
In any event, we will only process any personal data in Our possession if there is an identifiable explicit purpose for processing that personal data and the processing is based on one (or more) of the following legal grounds.
5. Legal basis
As part of our activities, we mainly process personal data on the following legal grounds:
| Nr. | Legal basis | Explanation |
| 1. | Conclusion and performance of the Contract | · data processing for the purpose of pre-contractual activities, the conclusion of a contract between Us and You and the performance of that contract |
| 2. | Compliance with laws and regulations | · data processing for the purpose of pre-contractual activities, the conclusion of a contract between Us and You and the performance of that contract |
| 3. | Our legitimate interests |
· to carry out commercial activity; |
| 4. | Your consent |
· data processing based on Your consent, which is expressed as an active step, including by contacting us and providing Your personal data or taking other active steps* * The Customer gives consent to the processing of personal data for which consent is the legal basis (e.g., to receive commercial communications, to analyse personal data, to receive loyalty cards) in writing in person, electronically on Our website and mobile applications or at any other location where We organise marketing activities and offer a relevant opportunity; The Customer has the right to withdraw the consent for data processing at any time in the same way as it was given and by writing to us by e-mail: [email protected]. In such a case, no further processing based on the consent previously given for the specific purpose will be carried out. Please note that the withdrawal of consent does not affect the processing of data carried out at the time when the Customer's consent was valid. Withdrawal of consent cannot interrupt the processing of data carried out on the basis of other legal grounds. |
| 5. | Protection of vital interests of natural persons | · processing carried out in an emergency case for the protection of the vital interests of the data subject or of another natural person |
6. Processing of personal data within the context of direct marketing
In individual cases, we may also process Your personal data for the purposes of direct marketing. in this case we can e-mail You the following:
1) information about news, Our offers, etc.;
2) invitations to participate in events organised by Us and Our cooperation partners, including sending summaries and conclusions related to these events;
3) invitations to take part in surveys, interviews, etc.;
4) invitations to fill in feedback forms, etc.
At the same time, please note that we will only process Your personal data for direct marketing only in the following cases:
1) where You have given unambiguous, explicit, and prior consent (i.e., You have opted in to receive direct marketing messages and thus provided Your personal data (email, name, surname) – the so-called “opt-in” principle), or
2) if You are already Our customer who has not explicitly objected to the processing of Your previously provided personal data (email, name, surname) for the purpose of receiving direct marketing messages about similar services offered by us (i.e., in this case, We will use Your e-mail address previously obtained from You in the course of our business activities – the so-called “soft opt-in” principle).
Please also note that You may opt-out of receiving direct marketing messages at any time. This can be done in the following ways:
1) by selecting the free option in the relevant direct marketing message;
2) by writing to: [email protected] or to the legal addresses indicated in Clause 1
7. Security and protection of the processing of personal data
We process Customer Data using state-of-the-art technology, considering the privacy risks involved and the organisational, financial and technical resources available to Us.
As the data controller, we provide:
1) confidentiality of personal data, ensuring that personal data are processed (including accessed) only by persons who need to do so in order to carry out their professional duties. Our representatives who handle information containing personal data as part of their day-to-day work are trained in personal data protection measures and are contractually bound by confidentiality obligations;
2) appropriate technical and organisational measures to protect personal data. Such measures shall include, as far as possible, considering the level of equipment, costs of implementation and the nature, extent, context and purposes of the processing, as well as the risks of various degree with regard to rights and freedoms of natural persons, for example, pseudonymisation of personal data, data minimisation, physical and logical data protection measures in the working environment, as well as creation of back-ups, etc.;
3) only tested, licensed, and updated software. We regularly review, update, and improve our technical and organisational measures;
4) data security, including by using the following technical solutions: data encryption (SSL), firewalls, intrusion protection and detection software;
5) involvement of certified personal data protection officers in the processing of personal data and the implementation of personal data protection measures.
8. Automated decision-making
We may use automated decisions in relation to the Customer. However, any automated decision-making that has legal consequences for the Customer (e.g. approval or rejection of the Customer's application) may only be carried out in the course of the conclusion or performance of a contract between Us and the Customer or on the basis of the Customer's explicit consen
9. Categories of recipients and transfers of personal datat.
We do not disclose any information to third parties obtained in the course of the provision of the services and the contract, including information about goods and services received, except:
1) information required by insurance companies for the preparation of an insurance offer and contract;
2) subject to the Customer's express and unambiguous consent;
3) to the persons provided for in external laws and regulations upon their justified request, in the manner and to the extent provided for therein;
4) in the cases provided for in external laws and regulations for the protection of Our legitimate interests, for example, by taking legal action against a person who has infringed Our legitimate interests before court or other public authorities.
We do not transfer personal data to other parties where there is no legal basis for such transfer and there is no pre-defined purpose for the processing of personal data, and where those third parties, taking into account the nature, extent, context and purposes of the processing, as well as the varying likelihood and severity of risks to the rights and freedoms of natural persons, are unable to provide, in a transparent manner, adequate technical and organisational measures to ensure and be able to demonstrate that the processing of personal data is carried out in accordance with the laws and regulations, and/or are unable to provide reasonable assurances that the security of processing of personal data and respect for the rights of data subjects will be ensured.
For different purposes personal data may be transferred:
1) to our employees or specially authorised persons;
2) to local government institutions, courts, law enforcement institutions, upon a reasoned request of these persons, in the manner and to the extent established by law;
3) to personal data processors by concluding appropriate data processing agreements
4) to business partners (e.g., sworn advocates, auditors, accountants, credit institutions, insurers) involved in organising and ensuring our activities;
5) to other partner companies involved in the Group or in the provision of various services and products (including both vertical and horizontal partners such as importers, factories, dealers, certified service partners as well as other contractual partners) in the value chain for the Volkswagen or Audi brand, for example, for the following purposes:
a) to enable You to use various products We offer, including the opportunity for you to obtain full user experience and service they provide, as well as
b) to maintain customer relationships
Data transfer to third countries
We do not transfer personal data to third countries (outside the European Union and the European Economic Area).
At the same time, Microsoft Ireland Operations Limited, which provides services to Us, may transfer personal data to countries outside the European Economic Area in which Microsoft Corporation or one of its sub-processors operates. The data transfer conducted by Microsoft Corporation is carried out in accordance with Chapter V of the Regulation, using standard contractual clauses established by the competent EU organisation together with additional technical and organisational measures. For detailed information on data transfer and the technical and organisational measures used, please refer to the Microsoft Corporation Data Protection Rules, available here.
10. Duration of storage
We store and process Customer Personal Data as long as at least one of the following criteria applies:
1) only for as long as the contract with the Customer is valid or the service is provided to the Customer;
2) data is necessary for the purpose for which it was collected;
3) pending full consideration and/or execution of the Customer's application;
4) until We or the Customer can exercise their legitimate interests (e.g., file an objection or take legal action) in accordance with the procedure established by external laws and regulations;
5) as long as We are legally bound to store the data;
6) as long as the Customer's consent to the processing of personal data is valid unless there is another lawful basis for the processing.
Below are some possible deadlines for the most common categories of data:
| Nr. | Position | Deadline |
| 1. | Information about the insurance contract | We store information about your insurance contract for 3 years after the end of the contract, unless other laws apply |
| 2. | Contact details and Contact information from marketing events | 6 months |
| 3. | Our communication | 2 years or as long as the customer relationship exists |
| 4. | Insurance offers and price calculation on the Internet, if no insurance contract is concluded | 18 months |
| 5. | Participation in customer satisfaction surveys | See the information for each specific survey (CEM) before You complete it |
| 6. | Information from marketing surveys where You choose not to remain anonymous | See the information on each specific survey before You complete it |
After these circumstances cease to exist, the Customer's personal data is deleted.
11. Your rights as a customer
You have the right to receive information in relation to the processing of Your data.
You also have the right, in accordance with the laws and regulations, to request access to Your personal data, to request Us to supplement, rectify or delete it, or to restrict processing, or to object to processing (including processing of personal data based on Our legitimate interests), as well as the right to data portability.
These rights shall be exercisable to the extent that the processing of data does not result from Our obligations imposed by the applicable laws and regulations and which are carried out in the public interest.
You can make a request to exercise Your rights as follows:
1) by sending them in writing to the registered address of the controller concerned indicated in Clause 1;
2) by e-mail, signed with a secure electronic signature and sent to the e-mail address – [email protected] .
Upon receipt of a request from a Customer to exercise its rights, We will first verify the identity of the Customer, including, if necessary, exercise our right to request the Customer to provide additional information in this regard, assess the request and comply with it in accordance with laws and regulations. Our reply to the Customer shall be sent by post to the contact address provided by the Customer by registered letter or by email with a secure electronic signature (if the application has been submitted with a secure electronic signature), where possible, considering the method of receipt of the reply indicated by the Customer.
The Customer has the right to receive a copy of his personal data processed free of charge. The receipt and/or use of such information may be restricted to prevent adverse effects on the rights and freedoms of others (including Our employees).
We ensure compliance with data processing and data protection requirements in accordance with laws and regulations and, in the event of an objection by the Customer, take reasonable steps to resolve the objection. However, if this fails, the Customer has the right to apply to the supervisory authority – the Data State Inspectorate (the address of the Data State Inspectorate is: 11/13 Blaumaņa Street, Riga, LV-1011, but detailed information is available on the website www.dvi.gov.lv ,or by calling 67 22 31 31 or writing [email protected] ), which monitors the compliance of personal data processing activities within the regulatory framework in Latvia.
You can exercise all of the above rights by sending a request and contacting us by email [email protected] or by writing to us to the registered office of the relevant controller indicated in Clause 1. We encourage You to contact us before making a formal complaint in order to find the quickest and most effective solution to the problem.
We are committed to ensuring the accuracy of personal data and rely on our Customers, suppliers and other third parties which transfer personal data to ensure the completeness and accuracy of the personal data transferred.
12. Final provisions
We have the unilateral right to make amendments and/or additions to this Policy. The current version of the Policy is always posted on the website. We maintain previous versions of the Policy and they are available on the aforementioned website.